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CLAIMS 

We claim: 

5r A computing system comprising: 

a general purpose microprocessor for executing a predetermined 
software application; and, 

a monitoring microprocessor having an assurance characteristic which is 
higher and having^a performance characteristic which is lower than that of said 
general purpose microprocessor; said monitoring microprocessor coupled to and 
monitoring said general purpose microprocessor, where said monitoring does 
not involve real-time comparison of parallel computations made on parallel 
microprocessors. \ 

2. A system of claim 1 wherein said general purpose microprocessor 
generates state transitions as said predetermined software application is 
executed. \ 




3. A system of claim 2 wherein said monitoring microprocessor 
monitors said state transitions and generates a fault signal when a determination 
of invalidity of said state transitions is made by said monitoring microprocessor. 
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A system of claim 3 wherein said fault signal is a reset signal sent 
to said general purpose microprocessor. 



5. AWstem of claim 4 wherein said monitoring microprocessor has 
associated therewith a certification from an agency of the US government which 
regulates safety. 



6. A system of (slaim 5 wherein said predetermined software 
application has associated therewith a certification from an agency of the U.S. 
government which regulates safety. 



7. A system of claim 1 wherein said monitoring involves comparing a 
value generated by said general purpose microprocessor with a value based 
upon predetermined criteria, which relate\o physical and operational limitations 
of an aircraft. 
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A system of claim 7 wherein said predetermined criteria include 
limitation^ on rates of change of said value generated by said general purpose 
microprocessor. 



9. A system of claim 7 wherein said predetermined criteria are stored 
in a look-up table coupled to said monitoring microprocessor. 



10. A system of claim 7 wherein said general purpose microprocessor 
is coupled with an instruction trace buffer disposed on a chip carrying said 
general purpose microprocessor, wherein said instruction trace buffer temporarily 
stores instructions as they are executed by said general purpose microprocessor, 
so as to be retrievable in an eve\t that a fault signal is generated by said 
monitoring microprocessor. 



11. A system of claim 1 wherefn said monitoring microprocessor and 
said general purpose microprocessor execute derived dissimilar programs, which 
are derived from a common predetermined software application, where a 
software conversion tool is used to derive saia\dissimilar programs. 
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t2. A system of claim 1 1 wherein said software conversion tool is a tool 
having associated therewith a certification from an agency of the US government 
which regulates safety. 

13. A system of claim 12 wherein software conversion tool causes said 
predetermined software application to generate state transition signals when 
executed on said general purpose microprocessor. 

means, on-board an aircraft for executing a predetermined avionics 
software application which has beenYertified by an agency of the U.S. 
government which regulates safety; \ 

means, on-board an aircraft, for enhancing an integrity characteristic of 
said means for executing; and, \ 

said means for enhancing not involving a comparison of outputs of parallel 
computing machines. \ 
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15. r An avionics system of claim 14 wherein said means, on-board an 
aircraft, forenhancing is a virtual machine implemented with said means, on- 
board an aircraft, for executing. 



16. An avicanics system of claim 14 wherein said means, on-board an 
aircraft, for enhancing is an independent microprocessor. 



17. An avionics system of claim14 wherein said means, on-board an 
aircraft, forenhancing, comprises: 

a comparison between 1) a talue generated by said means, on-board an 
aircraft, for executing; and 2) a predetermined criteria indicating a validity 
characteristic of said value. 
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^ 1 A method of enhancing an integrity characteristic of an airborne 

avionics computing system comprising the steps of: 

providing a first microprocessor, which executes a predetermined avionics 
software application, and thereby generates a calculated value; 

providing a second microprocessor which is coupled to said first 
microprocessor; and, 

enhancing an integrity of said calculated value by monitoring, with said 
second processor, an output of said first microprocessor, where said monitoring 
is not a comparison of paralleYcomputations made by parallel processors. 



yj 



1 9. A method of claim 1 8 ^herein said step of enhancing includes the 
steps of: 

generating state transition signals during an execution of said 
predetermined avionics software applicatior 

comparing said state transition signals, ify said second microprocessor, 
against predetermined criteria and generating a f\ult signal in response thereto; 
and, 

resetting said first microprocessor in response t\ said fault signal. 
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2& A method of claim 18 wherein said step of enhancing includes the 
steps of: \ 

comparing said calculated value to predetermined limitations associated 
with physical limitations of an aircraft; and, 

generating a faulrsignal when said calculated value exceeds said 
predetermined limitations. \ 



